Which feature of the CrowdStrike Identity Analyzer enables administrators to determine the last time a specific user changed their password across the cloud infrastructure?

The CrowdStrike Identity Analyzer, a core component of Falcon Identity Threat Protection, provides deep visibility into an organization's identity posture. It enables administrators to monitor user accounts for signs of risk, including stale credentials. The feature that specifically allows for determining the last time a user's password was changed is functionally a "Last Password Change Tracker." This capability is essential for identifying accounts with old passwords that may violate security policies or indicate dormancy, thereby reducing the attack surface.

B. Password Policy Manager: This type of feature is used to define and enforce password requirements (e.g., complexity, length, expiration), not to track the last change date for a specific user.
C. Identity Change Log: An identity change log is a broader audit trail that records various identity-related events, making it less direct for quickly determining the specific last password change timestamp.
D. Access Key Analyzer: This feature is designed to monitor and analyze the usage and risk associated with programmatic credentials, such as API or cloud access keys, not user passwords.

1. CrowdStrike Falcon® Platform Documentation, Identity Threat Protection: The documentation for the Identity Analyzer dashboard details its function in providing a comprehensive view of identity security posture. It explicitly mentions capabilities for identifying at-risk identities, which includes monitoring password age and identifying stale credentials by tracking attributes like pwdLastSet. This core function is what the "Last Password Change Tracker" represents. (Accessed via official CrowdStrike support portal documentation for Falcon Identity Threat Protection).

2. CrowdStrike, Falcon Identity Threat Protection Datasheet, 2023: This document outlines the key features of the solution, including "Continuous posture assessment" and visibility into "stale credentials." The ability to identify stale credentials is fundamentally dependent on tracking the last password change date for each user account. (Document available from the official CrowdStrike website).